diff --git a/helmet/helmet-tests.ts b/helmet/helmet-tests.ts index d2509a022..83fd224a7 100644 --- a/helmet/helmet-tests.ts +++ b/helmet/helmet-tests.ts @@ -15,11 +15,45 @@ function helmetTest() { /** * @summary Test for {@see helmet#xssFilter} function. */ -function contentSecurityPolicyTest() { +function xssFilterTest() { app.use(helmet.xssFilter()); app.use(helmet.xssFilter({ setOnOldIE: true })); } +/** + * @summary Test for {@see helmet#csp} function + */ + +function contentSecurityPolicyTest() { + + // taken directly from helmet-csp docs + const config = { + // Specify directives as normal. + directives: { + defaultSrc: ["'self'", 'default.com'], + scriptSrc: ["'self'", "'unsafe-inline'"], + styleSrc: ['style.com'], + imgSrc: ['img.com', 'data:'], + sandbox: ['allow-forms', 'allow-scripts'], + reportUri: '/report-violation', + + objectSrc: ["'self'"], // An empty array allows nothing through + }, + + // Set to true if you only want browsers to report errors, not block them + reportOnly: false, + + // Set to true if you want to blindly set all headers: Content-Security-Policy, + // X-WebKit-CSP, and X-Content-Security-Policy. + setAllHeaders: false, + + // Set to true if you want to disable CSP on Android where it can be buggy. + disableAndroid: false + } + app.use(helmet.csp()); + app.use(helmet.contentSecurityPolicy(config)); +} + /** * @summary Test for {@see helmet#frameguard} function. */ diff --git a/helmet/helmet.d.ts b/helmet/helmet.d.ts index 35d9bf3ae..4d07730db 100644 --- a/helmet/helmet.d.ts +++ b/helmet/helmet.d.ts @@ -7,7 +7,24 @@ declare module "helmet" { import express = require("express"); - + + interface IHelmetCspDirectives { + defaultSrc? : string[]; + scriptSrc? : string[]; + styleSrc? : string[]; + imgSrc? : string[]; + sandbox? : string[]; + reportUri? : string; + objectSrc? : string[]; + } + + interface IHelmetCspConfiguration { + reportOnly? : boolean; + setAllHeaders? : boolean; + disableAndroid? : boolean; + directives? : IHelmetCspDirectives + } + /** * @summary Interface for helmet class. * @interface @@ -70,6 +87,19 @@ declare module "helmet" { * @param {Object} options The options. */ xssFilter(options ?: Object):express.RequestHandler; + + /** + * @summary Set policy around third-party content via headers + * @return {RequestHandler} The Request handler + * @param {Object} options The options + */ + csp(options ?: IHelmetCspConfiguration): express.RequestHandler; + + /** + * @see csp + */ + contentSecurityPolicy(options ?: IHelmetCspConfiguration): express.RequestHandler; + } var helmet: Helmet;